CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6064 vulnerabilities reference this CWE, most recent first.
GHSA-C3C6-GGQG-7CRV
Vulnerability from github – Published: 2025-12-03 18:30 – Updated: 2025-12-03 18:30In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability change_authentication could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.
{
"affected": [],
"aliases": [
"CVE-2025-20388"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-03T17:15:51Z",
"severity": "LOW"
},
"details": "In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.",
"id": "GHSA-c3c6-ggqg-7crv",
"modified": "2025-12-03T18:30:25Z",
"published": "2025-12-03T18:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20388"
},
{
"type": "WEB",
"url": "https://advisory.splunk.com/advisories/SVD-2025-1207"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C3CH-22RQ-XFWR
Vulnerability from github – Published: 2026-05-15 18:35 – Updated: 2026-06-09 10:28CVE-2026-43884 fix 603e7bf patched EpgParser.php and plugin/AI/receiveAsync.json.php to use url_get_contents (redirect-safe). Neither uses the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE. Six+ other call sites still discard $resolvedIP, opening DNS-rebinding TOCTOU.
Reference correct pattern at plugin/YPTWallet/YPTWallet.php:1071-1098:
```php $resolvedIP = null; if (isSSRFSafeURL($url, $resolvedIP)) { curl_setopt($ch, CURLOPT_RESOLVE, ["$h
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "WWBN/AVideo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "29.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45619"
],
"database_specific": {
"cwe_ids": [
"CWE-367",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-15T18:35:38Z",
"nvd_published_at": "2026-05-29T14:16:30Z",
"severity": "MODERATE"
},
"details": "CVE-2026-43884 fix `603e7bf` patched `EpgParser.php` and `plugin/AI/receiveAsync.json.php` to use `url_get_contents` (redirect-safe). Neither uses the `$resolvedIP` out-param of `isSSRFSafeURL()` for DNS pinning via `CURLOPT_RESOLVE`. Six+ other call sites still discard `$resolvedIP`, opening DNS-rebinding TOCTOU.\n\nReference correct pattern at `plugin/YPTWallet/YPTWallet.php:1071-1098`:\n\n```php\n$resolvedIP = null;\nif (isSSRFSafeURL($url, $resolvedIP)) {\n curl_setopt($ch, CURLOPT_RESOLVE, [\"$h",
"id": "GHSA-c3ch-22rq-xfwr",
"modified": "2026-06-09T10:28:08Z",
"published": "2026-05-15T18:35:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-c3ch-22rq-xfwr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45619"
},
{
"type": "PACKAGE",
"url": "https://github.com/WWBN/AVideo"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-2hch-c97c-g99x"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`"
}
GHSA-C3G6-9RGM-RG4M
Vulnerability from github – Published: 2026-09-18 06:31 – Updated: 2026-09-18 12:31The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generated PDF.
{
"affected": [],
"aliases": [
"CVE-2026-90984"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-18T06:16:41Z",
"severity": "MODERATE"
},
"details": "The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generated PDF.",
"id": "GHSA-c3g6-9rgm-rg4m",
"modified": "2026-09-18T12:31:15Z",
"published": "2026-09-18T06:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90984"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/1aa459e4-bd75-49a5-a6de-812375d441e6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C3J4-JV4J-WGMF
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack. IBM X-Force ID: 148939.
{
"affected": [],
"aliases": [
"CVE-2018-1789"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-07T15:29:00Z",
"severity": "CRITICAL"
},
"details": "IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack. IBM X-Force ID: 148939.",
"id": "GHSA-c3j4-jv4j-wgmf",
"modified": "2022-05-13T01:32:40Z",
"published": "2022-05-13T01:32:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1789"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/148939"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10728517"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-C3Q8-HH69-7MG5
Vulnerability from github – Published: 2022-05-24 17:26 – Updated: 2024-04-25 22:19A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges could use the plugin install feature to make the server request any URL via components/market/class.market.php. This could potentially result in remote code execution. NOTE: the vendor states "Codiad is no longer under active maintenance by core contributors."
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "codiad/codiad"
},
"ranges": [
{
"events": [
{
"introduced": "1.7.8"
},
{
"last_affected": "2.8.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-14044"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T22:19:54Z",
"nvd_published_at": "2020-08-24T16:15:00Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges could use the plugin install feature to make the server request any URL via components/market/class.market.php. This could potentially result in remote code execution. **NOTE:** the vendor states \"Codiad is no longer under active maintenance by core contributors.\"",
"id": "GHSA-c3q8-hh69-7mg5",
"modified": "2024-04-25T22:19:54Z",
"published": "2022-05-24T17:26:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14044"
},
{
"type": "WEB",
"url": "https://github.com/Codiad/Codiad/issues/1122"
},
{
"type": "WEB",
"url": "https://github.com/Codiad/Codiad/issues/1132"
},
{
"type": "WEB",
"url": "https://advisory.checkmarx.net/advisory/CX-2020-4280"
},
{
"type": "PACKAGE",
"url": "https://github.com/Codiad/Codiad"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Codiad SSRF Vulnerability"
}
GHSA-C3RP-7VXJ-5H98
Vulnerability from github – Published: 2022-05-24 16:52 – Updated: 2024-04-04 01:35Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL.
{
"affected": [],
"aliases": [
"CVE-2019-12994"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-08T18:15:00Z",
"severity": "CRITICAL"
},
"details": "Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL.",
"id": "GHSA-c3rp-7vxj-5h98",
"modified": "2024-04-04T01:35:22Z",
"published": "2022-05-24T16:52:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12994"
},
{
"type": "WEB",
"url": "https://www.excellium-services.com/cert-xlm-advisory/CVE-2019-12994"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C3W9-49H5-9JJQ
Vulnerability from github – Published: 2026-09-16 03:31 – Updated: 2026-09-16 03:31A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py of the component FileResolver. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The identifier of the patch is 2bb8423060308bbdea8ba468dabed4fc256d18ea. To fix this issue, it is recommended to deploy a patch.
{
"affected": [],
"aliases": [
"CVE-2026-92215"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T02:17:38Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py of the component FileResolver. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The identifier of the patch is 2bb8423060308bbdea8ba468dabed4fc256d18ea. To fix this issue, it is recommended to deploy a patch.",
"id": "GHSA-c3w9-49h5-9jjq",
"modified": "2026-09-16T03:31:10Z",
"published": "2026-09-16T03:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92215"
},
{
"type": "WEB",
"url": "https://github.com/a2ui-project/a2ui/issues/2295"
},
{
"type": "WEB",
"url": "https://github.com/a2ui-project/a2ui/pull/2390"
},
{
"type": "WEB",
"url": "https://github.com/a2ui-project/a2ui/commit/2bb8423060308bbdea8ba468dabed4fc256d18ea"
},
{
"type": "WEB",
"url": "https://github.com/a2ui-project/a2ui"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-92215"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/934109"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/404460"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/404460/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-C438-6F6R-PG8W
Vulnerability from github – Published: 2022-08-16 00:00 – Updated: 2022-08-18 19:18An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked CALLBACK parameter in the request header. As of 2022, 4thline cling is no longer supported by the maintainers.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.fourthline.cling:cling-core"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"last_affected": "2.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-23622"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2022-08-18T19:18:55Z",
"nvd_published_at": "2022-08-15T20:15:00Z",
"severity": "HIGH"
},
"details": "An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked `CALLBACK` parameter in the request header. As of 2022, 4thline cling is no longer supported by the maintainers.",
"id": "GHSA-c438-6f6r-pg8w",
"modified": "2022-08-18T19:18:55Z",
"published": "2022-08-16T00:00:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-23622"
},
{
"type": "WEB",
"url": "https://github.com/4thline/cling/issues/253"
},
{
"type": "PACKAGE",
"url": "https://github.com/4thline/cling"
},
{
"type": "WEB",
"url": "https://zh-cn.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-billions-of?tns_redirect=true"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "4thline cling uPnP protocol issue can lead to denial of service"
}
GHSA-C489-8G9Q-RFQ7
Vulnerability from github – Published: 2026-09-03 15:32 – Updated: 2026-09-03 15:32WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal services, with responses written to publicly accessible web paths for retrieval.
{
"affected": [],
"aliases": [
"CVE-2026-85164"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T13:06:23Z",
"severity": "HIGH"
},
"details": "WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal services, with responses written to publicly accessible web paths for retrieval.",
"id": "GHSA-c489-8g9q-rfq7",
"modified": "2026-09-03T15:32:19Z",
"published": "2026-09-03T15:32:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-xq33-878j-m9w8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85164"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/wwbn-avideo-server-side-request-forgery-via-set-api-userimages"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-C4HG-6933-X62X
Vulnerability from github – Published: 2026-04-13 15:31 – Updated: 2026-07-21 13:56Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP.
This issue affects Apache SkyWalking MCP: 0.1.0.
Users are recommended to upgrade to version 0.2.0, which fixes this issue.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/apache/skywalking-mcp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-34476"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-14T23:16:30Z",
"nvd_published_at": "2026-04-13T13:16:40Z",
"severity": "HIGH"
},
"details": "Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP.\n\nThis issue affects Apache SkyWalking MCP: 0.1.0.\n\nUsers are recommended to upgrade to version 0.2.0, which fixes this issue.",
"id": "GHSA-c4hg-6933-x62x",
"modified": "2026-07-21T13:56:29Z",
"published": "2026-04-13T15:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34476"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-c4hg-6933-x62x"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/skywalking-mcp"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/v0k1xyzzbtnpyrwxwyn36pbspr8rhjnr"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/04/13/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.